Netfilter
Monthly
A use-after-free race in the Linux kernel's nfnetlink_cttimeout netfilter module lets a local attacker who holds CAP_NET_ADMIN and can trigger module unload or network-namespace teardown crash or corrupt kernel memory via the connection-tracking timeout policy path. The flaw exists because cttimeout_exit() unregisters the per-net operations (freeing the per-net timeout storage) before clearing the nf_ct_timeout_hook, so a concurrent nf_ct_set_timeout() call reached through an iptables/xtables CT target can dereference the stale hook and read already-freed memory. KASAN-reported use-after-free; no public exploit identified at time of analysis, and exploitation requires a narrow timing race plus elevated privileges (CAP_NET_ADMIN, and CAP_SYS_MODULE/root or repeated netns churn), so the practical outcome is a kernel crash rather than controlled corruption.
Linux kernel netfilter logging (the nf_log_syslog and nfnetlink_log backends) contains a teardown-ordering race that leaves a stale per-network-namespace logger pointer which later sysctl reads or packet-logging operations dereference. A local actor able to rebind the kernel's log backend - realistically requiring CAP_NET_ADMIN in the target network namespace - must win a narrow timing window against module unload or network-namespace exit, so the assessed impact is no confidentiality loss, limited integrity impact, and high availability impact (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Vendor patches are available in stable releases 6.12.111, 6.18.53 and 7.2.7 (mainline 7.3-rc3), and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Memory-safety corruption in the Linux kernel's netfilter nft_ct conntrack expectation code lets a local user with CAP_NET_ADMIN in a network namespace leave a stale hlist pointer (.pprev) behind after the conntrack extension area is reallocated, enabling use-after-free style reads and writes against freed memory. Affected systems run kernels from 5.3 up to the versions fixed by 7.2.6 and 7.3-rc1, and exploitation requires the nf_conntrack/nft_ct subsystem to be in use plus the ability to install an nft_ct rule that creates custom expectations and then drive matching traffic; the assessed CVSS is 5.9 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H), meaning denial of service and limited disclosure/modification rather than the C:H/I:H/A:H impact suggested by the vendor's 7.8 score. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the affected code path is reachable by unprivileged users on multi-tenant or container hosts where unprivileged user namespaces are enabled.
Netfilter nf_tables in the Linux kernel performed the hardware-offload step before allocating the chain blob during ruleset commits, so an allocation failure at that point could leave the NIC-offloaded ruleset diverging from the in-kernel software ruleset. Affected are Linux kernel builds with nf_tables hardware offload enabled on an offload-capable NIC; the fix landed in stable releases 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52 and 7.2.6/7.3-rc1, and the bug traces back to code introduced in the 5.3 series. Exploitation requires local access with CAP_NET_ADMIN and an error/resource-pressure path, so no public exploit has been identified at time of analysis.
A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or potentially gain code execution via a specially crafted iptables-save file. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. Public exploit code available.
conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of service (crash) via a. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
A use-after-free race in the Linux kernel's nfnetlink_cttimeout netfilter module lets a local attacker who holds CAP_NET_ADMIN and can trigger module unload or network-namespace teardown crash or corrupt kernel memory via the connection-tracking timeout policy path. The flaw exists because cttimeout_exit() unregisters the per-net operations (freeing the per-net timeout storage) before clearing the nf_ct_timeout_hook, so a concurrent nf_ct_set_timeout() call reached through an iptables/xtables CT target can dereference the stale hook and read already-freed memory. KASAN-reported use-after-free; no public exploit identified at time of analysis, and exploitation requires a narrow timing race plus elevated privileges (CAP_NET_ADMIN, and CAP_SYS_MODULE/root or repeated netns churn), so the practical outcome is a kernel crash rather than controlled corruption.
Linux kernel netfilter logging (the nf_log_syslog and nfnetlink_log backends) contains a teardown-ordering race that leaves a stale per-network-namespace logger pointer which later sysctl reads or packet-logging operations dereference. A local actor able to rebind the kernel's log backend - realistically requiring CAP_NET_ADMIN in the target network namespace - must win a narrow timing window against module unload or network-namespace exit, so the assessed impact is no confidentiality loss, limited integrity impact, and high availability impact (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Vendor patches are available in stable releases 6.12.111, 6.18.53 and 7.2.7 (mainline 7.3-rc3), and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Memory-safety corruption in the Linux kernel's netfilter nft_ct conntrack expectation code lets a local user with CAP_NET_ADMIN in a network namespace leave a stale hlist pointer (.pprev) behind after the conntrack extension area is reallocated, enabling use-after-free style reads and writes against freed memory. Affected systems run kernels from 5.3 up to the versions fixed by 7.2.6 and 7.3-rc1, and exploitation requires the nf_conntrack/nft_ct subsystem to be in use plus the ability to install an nft_ct rule that creates custom expectations and then drive matching traffic; the assessed CVSS is 5.9 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H), meaning denial of service and limited disclosure/modification rather than the C:H/I:H/A:H impact suggested by the vendor's 7.8 score. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the affected code path is reachable by unprivileged users on multi-tenant or container hosts where unprivileged user namespaces are enabled.
Netfilter nf_tables in the Linux kernel performed the hardware-offload step before allocating the chain blob during ruleset commits, so an allocation failure at that point could leave the NIC-offloaded ruleset diverging from the in-kernel software ruleset. Affected are Linux kernel builds with nf_tables hardware offload enabled on an offload-capable NIC; the fix landed in stable releases 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52 and 7.2.6/7.3-rc1, and the bug traces back to code introduced in the 5.3 series. Exploitation requires local access with CAP_NET_ADMIN and an error/resource-pressure path, so no public exploit has been identified at time of analysis.
A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or potentially gain code execution via a specially crafted iptables-save file. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. Public exploit code available.
conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of service (crash) via a. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.